diff options
Diffstat (limited to 'src/sp/transport/dtls')
| -rw-r--r-- | src/sp/transport/dtls/dtls.c | 49 | ||||
| -rw-r--r-- | src/sp/transport/dtls/dtls_tran_test.c | 81 |
2 files changed, 110 insertions, 20 deletions
diff --git a/src/sp/transport/dtls/dtls.c b/src/sp/transport/dtls/dtls.c index e95560de..400709a1 100644 --- a/src/sp/transport/dtls/dtls.c +++ b/src/sp/transport/dtls/dtls.c @@ -6,18 +6,18 @@ // found online at https://opensource.org/licenses/MIT. // -#include "core/aio.h" -#include "core/defs.h" -#include "core/idhash.h" -#include "core/message.h" -#include "core/nng_impl.h" -#include "core/options.h" -#include "core/pipe.h" -#include "core/platform.h" -#include "core/socket.h" -#include "core/stats.h" +#include "../../../core/aio.h" +#include "../../../core/defs.h" +#include "../../../core/idhash.h" +#include "../../../core/message.h" +#include "../../../core/nng_impl.h" +#include "../../../core/options.h" +#include "../../../core/pipe.h" +#include "../../../core/platform.h" +#include "../../../core/socket.h" +#include "../../../core/stats.h" +#include "../../../supplemental/tls/tls_common.h" #include "nng/nng.h" -#include "supplemental/tls/tls_common.h" #include <string.h> @@ -1070,6 +1070,14 @@ dtls_pipe_getopt( return (nni_getopt(dtls_pipe_options, name, p, buf, szp, t)); } +static nng_err +dtls_pipe_peer_cert(void *arg, nng_tls_cert **certp) +{ + dtls_pipe *p = arg; + + return (nni_tls_peer_cert(&p->tls, certp)); +} + static void dtls_ep_fini(void *arg) { @@ -1676,15 +1684,16 @@ dtls_ep_accept(void *arg, nni_aio *aio) } static nni_sp_pipe_ops dtls_pipe_ops = { - .p_size = dtls_pipe_size, - .p_init = dtls_pipe_init, - .p_fini = dtls_pipe_fini, - .p_stop = dtls_pipe_stop, - .p_send = dtls_pipe_send, - .p_recv = dtls_pipe_recv, - .p_close = dtls_pipe_close, - .p_peer = dtls_pipe_peer, - .p_getopt = dtls_pipe_getopt, + .p_size = dtls_pipe_size, + .p_init = dtls_pipe_init, + .p_fini = dtls_pipe_fini, + .p_stop = dtls_pipe_stop, + .p_send = dtls_pipe_send, + .p_recv = dtls_pipe_recv, + .p_close = dtls_pipe_close, + .p_peer = dtls_pipe_peer, + .p_getopt = dtls_pipe_getopt, + .p_peer_cert = dtls_pipe_peer_cert, }; static const nni_option dtls_ep_opts[] = { diff --git a/src/sp/transport/dtls/dtls_tran_test.c b/src/sp/transport/dtls/dtls_tran_test.c index 774c967a..7e604f30 100644 --- a/src/sp/transport/dtls/dtls_tran_test.c +++ b/src/sp/transport/dtls/dtls_tran_test.c @@ -513,6 +513,86 @@ test_dtls_psk(void) #endif } +void +test_dtls_pipe_details(void) +{ + nng_socket s1; + nng_socket s2; + nng_tls_config *c1, *c2; + nng_sockaddr sa; + nng_listener l; + nng_dialer d; + nng_msg *msg; + nng_pipe p; + const nng_url *url; + + c1 = tls_server_config_ecdsa(); + c2 = tls_client_config_ecdsa(); + + NUTS_ENABLE_LOG(NNG_LOG_DEBUG); + NUTS_OPEN(s1); + NUTS_OPEN(s2); + NUTS_PASS(nng_tls_config_auth_mode(c1, NNG_TLS_AUTH_MODE_REQUIRED)); + NUTS_PASS(nng_tls_config_ca_chain(c1, nuts_ecdsa_server_crt, NULL)); + NUTS_PASS(nng_tls_config_ca_chain(c2, nuts_ecdsa_server_crt, NULL)); + NUTS_PASS(nng_listener_create(&l, s1, "dtls://127.0.0.1:0")); + NUTS_PASS(nng_listener_set_tls(l, c1)); + NUTS_PASS(nng_listener_start(l, 0)); + NUTS_PASS(nng_listener_get_url(l, &url)); + NUTS_MATCH(nng_url_scheme(url), "dtls"); + NUTS_PASS(nng_listener_get_addr(l, NNG_OPT_LOCADDR, &sa)); + NUTS_TRUE(sa.s_in.sa_family == NNG_AF_INET); + NUTS_TRUE(sa.s_in.sa_port != 0); + NUTS_TRUE(sa.s_in.sa_addr = nuts_be32(0x7f000001)); + NUTS_PASS(nng_dialer_create_url(&d, s2, url)); + NUTS_PASS(nng_dialer_set_tls(d, c2)); + NUTS_PASS(nng_dialer_start(d, 0)); + nng_msleep(50); + NUTS_SEND(s1, "text"); + NUTS_PASS(nng_recvmsg(s2, &msg, 0)); + p = nng_msg_get_pipe(msg); + NUTS_TRUE(nng_pipe_id(p) >= 0); +#if !defined(NNG_TLS_ENGINE_WOLFSSL) || defined(NNG_WOLFSSL_HAVE_PEER_CERT) + // TOOD: maybe implement this -- although I think we want to move away + // from it. + // + // char *cn; NUTS_PASS(nng_pipe_get_string(p, + // NNG_OPT_TLS_PEER_CN, &cn)); NUTS_ASSERT(cn != NULL); NUTS_MATCH(cn, + // "127.0.0.1"); nng_strfree(cn); + + nng_tls_cert *cert; + char *name; + NUTS_PASS(nng_pipe_peer_cert(p, &cert)); + NUTS_PASS(nng_tls_cert_subject(cert, &name)); + NUTS_ASSERT(name != NULL); + nng_log_debug(NULL, "SUBJECT: %s", name); + NUTS_PASS(nng_tls_cert_issuer(cert, &name)); + NUTS_ASSERT(name != NULL); + nng_log_debug(NULL, "ISSUER: %s", name); + NUTS_PASS(nng_tls_cert_serial_number(cert, &name)); + NUTS_ASSERT(name != NULL); + nng_log_debug(NULL, "SERIAL: %s", name); + NUTS_PASS(nng_tls_cert_subject_cn(cert, &name)); + NUTS_MATCH(name, "127.0.0.1"); + NUTS_PASS(nng_tls_cert_next_alt(cert, &name)); + nng_log_debug(NULL, "FIRST ALT: %s", name); + NUTS_MATCH(name, "localhost"); + NUTS_FAIL(nng_tls_cert_next_alt(cert, &name), NNG_ENOENT); + struct tm when; + NUTS_PASS(nng_tls_cert_not_before(cert, &when)); + nng_log_debug(NULL, "BEGINS: %s", asctime(&when)); + NUTS_PASS(nng_tls_cert_not_after(cert, &when)); + nng_log_debug(NULL, "EXPIRES: %s", asctime(&when)); + + nng_tls_cert_free(cert); +#endif + nng_msg_free(msg); + NUTS_CLOSE(s2); + NUTS_CLOSE(s1); + nng_tls_config_free(c1); + nng_tls_config_free(c2); +} + NUTS_TESTS = { { "dtls port zero bind", test_dtls_port_zero_bind }, @@ -525,5 +605,6 @@ NUTS_TESTS = { { "dtls pre-shared key", test_dtls_psk }, { "dtls bad cert mutual", test_dtls_bad_cert_mutual }, { "dtls cert mutual", test_dtls_cert_mutual }, + { "dtls pipe details", test_dtls_pipe_details }, { NULL, NULL }, }; |